Legal
Privacy policy
How we collect, use, share and protect personal data, in line with the Nigeria Data Protection Act 2023.
Working draft, pending legal review before public launch.
Who we are
myATLAS operates this directory and is the data controller for the personal data described here. Contact our data protection lead at privacy@myatlas.example.
What we collect
- Account data: name, work email, job title and password (stored by our authentication provider as a salted hash).
- Listing data: company and product information that providers submit, including private verification evidence.
- Introduction requests: your name, business email, organization, role, problem description, requirements, timeline and optional budget.
- Reviews: your review, your stated role and company, and evidence of your business relationship.
- Usage data: searches, profile views and comparisons, linked to a random browser identifier or your account. We store a one-way hash of your IP address for abuse prevention, not the address itself.
Why we use it (lawful basis)
- To provide the service you asked for (contract): accounts, listings, introductions, reviews.
- With your consent: sharing an introduction request with the one provider you selected. You give this consent on the form.
- Legitimate interests: security, fraud and spam prevention, and improving search (for example, learning which searches return nothing).
- Legal obligations, where they apply.
Who we share it with
- The provider you choose, for an introduction request. Never other providers.
- Reviews are published only after moderation, showing your identity only as you chose. Private feedback is never shared with the provider.
- Service providers that host and run the platform (database, authentication, storage, email), under contract.
Some of these service providers may process data outside Nigeria. Where they do, we rely on safeguards permitted by the NDPA.
How long we keep it
| Data | Retention |
|---|---|
| Account data | Until you delete your account |
| Contact details in closed introduction requests | Redacted 24 months after the request closes |
| Usage analytics | Deleted after 13 months |
| Verification evidence | While the listing exists, then deleted |
| Audit logs | Kept for accountability while the listing exists |
Your rights
You can ask to access, correct, delete or port your data, object to processing, or withdraw consent. You can download your data and delete your account yourself from Account settings, or email us. You can also complain to the Nigeria Data Protection Commission.
Security
Data is encrypted in transit. Access is restricted by row-level security in the database. Evidence files are private and only reachable through short-lived signed links, and every access is logged.
Cookies
We use essential cookies to keep you signed in. We don't use advertising cookies.